CyberRota Analysis
AI-GeneratedThe vulnerability exists in Vitec Flamingo 4.12.2, where an unauthenticated OS command injection can be exploited through the admin/ajax/ping.php endpoint. This flaw allows remote attackers to execute arbitrary commands with root privileges due to improper handling of shell arguments, posing a critical risk to system integrity. Organizations using this version of Vitec Flamingo should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.